Triage Model in Service Monitoring System

2. The method of claim 1, wherein a notable event is generated by a search of the machine data, the search including criteria defining particular activity in the information technology environment.

5. The method of claim 1, wherein the action model is defined by an action model template comprising one or more substitution variables.

6. The method of claim 1, wherein the action model is defined by an action model instance specifying one or more values of respective substitution variables referenced by an action model template.

7. The method of claim 1, wherein the action model is defined by an action model instance specifying one or more values of respective substitution variables referenced by an action model template, wherein the one or more values of respective substitution variables are derived from historical data for a previous period.

9. The system of claim 8, wherein the action model is defined by an action model model template comprising one or more substitution variables.

10. The system of claim 8, wherein the action model is defined by an action model model instance specifying one or more values of respective substitution variables referenced by an action model model template.

11. The system of claim 8, wherein the action model is defined by an action model instance specifying one or more values of respective substitution variables referenced by an action model template, wherein the one or more values of respective substitution variables are derived from historical data for a previous period.

12. The system of claim 8, wherein a notable event is generated by a search of the machine data, the search including criteria defining particular activity in the information technology environment.

16. The non-transitory computer-readable storage medium of claim 15, wherein the action model is defined by an action model instance specifying one or more values of respective substitution variables referenced by an action model template.

17. The non-transitory computer-readable storage medium of claim 15, wherein the action model is defined by an action model instance specifying one or more values of respective substitution variables referenced by an action model template, wherein the one or more values of respective substitution variables are derived from historical data for a previous period.

18. The non-transitory computer-readable storage medium of claim 15, wherein a notable event is generated by a search of the machine data, the search including criteria defining particular activity in the information technology environment.